fix: wait for SPA rendering (networkidle) before running axe scan

[mvanhorn]

Summary

The scanner navigated with page.goto(url) and ran axe immediately, so single-page apps that render their content after initial load were scanned against a near-empty DOM, producing misleading "no violations" results (#201). This waits for the page to reach networkidle before scanning.

Changes

• After page.goto(url), await page.waitForLoadState('networkidle', { timeout: 30000 }) so client-rendered content is present before axe runs.
• The wait is wrapped in try/catch: a page that never reaches network idle (long-polling, websockets, analytics beacons) emits a core.warning and the scan proceeds rather than failing the run, preserving current behavior for those sites while fixing the common SPA case.

Testing

vitest run tests/findForUrl.test.ts — 7 passed, including a new case asserting the scan still runs (with a warning) when waitForLoadState times out, and that the wait is awaited before findings are collected.

Closes #201

AI was used for assistance.

[abdulahmad307]

are we sure this is the correct fix? according to the playwright docs page.goto waitUntil defaults to load;

When to consider operation succeeded, defaults to load

which is the recommended event. Also, networkIdle is discouraged;

'networkidle' - DISCOURAGED consider operation to be finished when there are no network connections for at least 500 ms. Don't use this method for testing, rely on web assertions to assess readiness instead

it specifically says: "rely on web assertions to assess readiness instead" - which would be something like waiting for a specific element to be rendered. Maybe we need to add a new input to the scanner (like an ID or class) for an element that we wait on to ensure the page is rendered fully.

** EDIT **
Actually, we have an input called url_configs, which is an array of objects. Each object has a url, and then other fields to provide configuration for each url. So we could add an element (or list of elements/selectors) that the scanner can wait for per url to ensure that the content is ready?

more info regarding page navigation in playwright (specifically the hydration section): https://playwright.dev/docs/navigations#hydration

[mvanhorn]

You're right, and thanks for the docs pointer - networkidle was the lazy version of this fix. Reworked in 450fddb: goto keeps its default load event, and readiness is now a web assertion (waiting for visible rendered content under body) with a warn-and-proceed fallback so intentionally minimal pages still get scanned. The timeout is exposed as an action input rather than hardcoded. Tests updated for both the late-rendering SPA path and the fallback path.

[mvanhorn]

You're right that Playwright discourages networkidle, and the docs' advice (rely on web assertions) is the correct pattern when you know the app under test. The catch here is that the scanner runs against arbitrary URLs - there are no app-specific selectors to assert on, so "wait for something meaningful" has no generic definition. load was the previous behavior and is exactly what caused #201: on SPA sites axe scanned the pre-hydration shell. networkidle is the discouraged-but-pragmatic heuristic for that case. Two alternatives I'm happy to implement if you prefer: (a) load + a DOM-stability window (MutationObserver quiet for N ms), avoiding the network heuristic entirely, or (b) keep load as default and expose the wait strategy as a flag so SPA-heavy scans opt in. Which direction do you want?

[mvanhorn]

Good call - reworked it in 59f8e50 to your url_configs suggestion. Each entry can now carry an optional waitForSelectors array; the scanner waits for each selector to be visible before running Axe, which is the web-assertion readiness the Playwright docs recommend. The generic rendered-content heuristic and its rendered_content_timeout input are gone. Input validation and tests cover the new field, and a selector that never appears fails that URL's scan the same way any other page error does, so a not-ready page can't produce false findings silently.